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Current intrusion detection and prevention systems seek to detect a wide class of network 
intrusions (e.g., DoS attacks, worms, port scans)at network vantage points. Unfortunately, 
all the IDS systems we know of keep per-connection or per-flow state. Thus it is hardly 
surprising that IDS systems (other than signature detection mechanisms) have not scaled 
to multi-gigabit speeds. By contrast, note that both router lookups and fair queuing have 
scaled to high speeds using <i>aggregation< ... 
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